Sector guide · Healthcare
DPDP Act for hospitals, clinics and health apps
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Every hospital, clinic, diagnostic lab and health app is a Data Fiduciary for its patients. Section 7 allows processing without consent in a medical emergency and for certain State health functions; everything else, including appointment booking, records, reminders and marketing, needs consent under Section 6 and a notice under Section 5.
From the Gevox Readiness Index: Eight of twenty advisor websites have no DPDP-compliant privacy notice; eight publish no privacy contact.
Emergencies are the exception, not the rule
Section 7(d) permits processing to respond to a medical emergency involving a threat to life or health, and Section 7(e) covers epidemics and public health. Those grounds end when the emergency does. Routine care, records, billing, follow-ups and any use of a phone number for anything beyond that care need consent.
Health data has no special category, and that cuts both ways
The Act does not define sensitive personal data. Health records are personal data like any other, with the same consent standard, the same erasure duty under Section 8(7) and the same breach clocks. The absence of a special category means no lighter regime either: a diagnostic report emailed to the wrong patient is a personal data breach under Section 2 and must be intimated under Rule 7.
Children are patients too
Under Section 2 a child is anyone under eighteen. Section 9 requires verifiable parental consent before processing a child’s data, with Rule 10 setting how it is verified. The Fourth Schedule and Rule 12 carve out limited processing by healthcare professionals and clinical establishments for health services, but the carve-out is for the care, not for marketing or profiling.
Where the scanner looks
Hospital websites typically run an appointment form through a third-party builder, a chat widget and analytics, all before any consent, and publish a privacy policy written for the 2011 SPDI Rules. The scanner tests the load order under Section 6, the notice against Rule 3, processor disclosure under Section 8(2) and the published contact under Section 8(9).
First five actions
- Separate emergency processing from routine processing in your notice and your consent flow.
- Rewrite the patient notice to Rule 3: what data, which purpose, how to withdraw, how to complain.
- Put a Section 8(2) contract in place with the HIS vendor, the lab, the messaging provider and the cloud host.
- Run the Rule 6 safeguards checklist, especially access control and one-year logging on patient records.
- Write the Rule 7 breach procedure; misdirected reports are the most common breach in this sector.
Questions people ask
- Can we send appointment reminders without consent?
- Reminders for care the patient asked for fall under Section 7(a), data provided voluntarily for that purpose. Health tips, offers or a newsletter are a different purpose and need consent.
- Do we need parental consent for a seventeen-year-old patient?
- Yes. Section 2 defines a child as under eighteen, and Section 9 requires verifiable consent from a parent or guardian, subject to the Fourth Schedule carve-outs for healthcare.
- Are we a Significant Data Fiduciary because we hold health data?
- Only if notified under Section 10. Volume and sensitivity are factors the Government weighs; the designation is not automatic.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.